Role Hierarchy: enter image description here User A is the Manager of User C and User B is the manager of User D. Now as per role hierarchy,Records created by User C & User D can be accessible to User A & User B.Although User A is not a manager of User D,he still can see the records owned by User D and Same for User B.

Our client is under impression that User A can see only those records owned by User C & User B can see only those records owned by User D.

Can someone please tell me if I want to restrict user A from viewing the records owned by User D and User B from viewing the records owned by User C.How can I restrict it?

  • What are the OWD and FLS settings for the object? Do all the users have the same profiles? There could be more to this than just Roles.
    – crmprogdev
    Jun 23, 2017 at 12:09
  • Org Wide Default Setting is Private and User C& D belongs to Same Profile and User A& User B also belongs to same profile but different profile that C& D has
    – SFDCDJ
    Jun 23, 2017 at 12:54

2 Answers 2


According to your requirement, you do not want to share via role hierarchy. Because if that is shared then any user can see subordinate's data irrespective of Manager's name defined in the user.

Just to let you know, Manager's name in the User is not related to data visibility. This field is especially useful for creating hierarchical workflow rules and approval processes without creating more hierarchy fields.

Here sometimes criteria based sharing rule does not fit into your requirement. Because, it may possible you want show subordinate's all data to his manager only.

Approach will be

  1. do not select Grant Access using Role Hierarchy for this object in Sharing Settings.

  2. Creating User Managed Sharing Using Apex. Refer Sharing a Record Using Apex for more information.

After record is created, then call this method and pass the userOrGroupId taking value from your User's Manager field.

If you want that the manager will get All types of access then use Force.com managed sharing.

Otherwise access can be Edit, Read.

Below is the code snippet as to how data can be shared.

Apex code

public class JobSharing {

   public static boolean manualShareRead(Id recordId, Id userOrGroupId){
      // Create new sharing object for the custom object Job.
      Job__Share jobShr  = new Job__Share();

      // Set the ID of record being shared.
      jobShr.ParentId = recordId;

      // Set the ID of user or group being granted access.
      jobShr.UserOrGroupId = userOrGroupId;

      // Set the access level.
      jobShr.AccessLevel = 'Read';

      // Set rowCause to 'manual' for manual sharing.
      // This line can be omitted as 'manual' is the default value for sharing objects.
      jobShr.RowCause = Schema.Job__Share.RowCause.Manual;

      // Insert the sharing record and capture the save result. 
      // The false parameter allows for partial processing if multiple records passed 
      // into the operation.
      Database.SaveResult sr = Database.insert(jobShr,false);

      // Process the save results.
         // Indicates success
         return true;
      else {
         // Get first save result error.
         Database.Error err = sr.getErrors()[0];

         // Check if the error is related to trival access level.
         // Access level must be more permissive than the object's default.
         // These sharing records are not required and thus an insert exception is acceptable. 
         if(err.getStatusCode() == StatusCode.FIELD_FILTER_VALIDATION_EXCEPTION  &&  
            // Indicates success.
            return true;
            // Indicates failure.
            return false;

  • If I'm not mistaken, this only works if you're using a custom object. Sharing via hierarchy can only be disabled for custom objects, not standard objects. Roles, in general, would need to be disabled (everyone has the same role) if you don't want any hierarchal sharing to occur with a private sharing model.
    – crmprogdev
    Jun 23, 2017 at 19:17
  • I have assumed he will be using custom objects. Jun 23, 2017 at 19:21
  • No,I am using Both Standard as well as Custom objects.Problem is Our Client is under impression that Only User's manager can see User's data no one else bot even Manager's manager.I have already shared with them couple of screenshots of how role hierarchy works.
    – SFDCDJ
    Jun 25, 2017 at 12:31
  • @SantanuBoral,Calvin.. Thanks for the knowledge.I have to look for Standard object in this case.
    – SFDCDJ
    Jun 25, 2017 at 12:36

This is possible within PE, EE and UE editions of Salesforce.com through Org Wide Default Settings and record ownership. When you purchase Salesforce.com, the system is wide open, meaning that everyone can see and edit everything. When you want to restrict access to even one user, you need to lower permissions on that object for everyone. Org Wide Defaults are set under Setup/Security Controls/Sharing Settings. By lowering the Org Wide Default on an object to Private, then only the record Owner and Users above the Owner in the Role Hierarchy can see and edit that record. Sharing Rules, also under Setup/Security Controls/Sharing Settings can be used to handle exceptions and grant access across Roles in the Role Hierarchy (and to Public Groups of Users).

Best of luck!

  • What kind of an exception should I add here? is it Something like,User A& User C belongs to US country and User B & User D belongs to UK.and If I add country criteria criteria in sharing rules like if country is US then only User A can access it not User B? We have Org Wide Default Setting as private for all objects and Grant Access using Role Hierarchy is enabled
    – SFDCDJ
    Jun 23, 2017 at 12:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .